Threat video1:00
Palo Alto Cortex XDR LLM Teardown: Analysis & Hunting
SpecterOps used LLMs to pull Cortex XDR's local detection logic and find allowlist gaps. Includes 9 detection rules (one free in Splunk SPL) and 12 IOCs.
Read the full threat intel for Palo Alto Cortex XDR LLM Teardown: Analysis & Hunting →
Chapters
- 0:00The hookAn AI agent mapped Cortex XDR rules.
- 0:04The storyA looping agent read local files, largely unattended.
- 0:11Attack pathReported: an agent ran a looping harness.
- 0:27AttributionNo threat actor is attributed.
- 0:31Indicators of compromise4 indicators to hunt: 3 file names and 1 path.
- 0:37MITRE ATT&CK techniques6 ATT&CK techniques, from reconnaissance to discovery.
- 0:42Remediation3 steps now: Do not rely on a single EDR verdict for credential-access.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00An AI agent mapped Cortex XDR rules.
0:05A looping agent read local files, largely unattended.
0:09It found allowlist gaps.
0:12Reported: an agent ran a looping harness.
0:15It surveyed files and decrypted the rules.
0:17It mined rules for allowlist gaps.
0:20A baseline export got caught, a variant didn't.
0:27No threat actor is attributed. Confidence: low.
0:324 indicators to hunt: 3 file names and 1 path.
0:386 ATT&CK techniques, from reconnaissance to discovery.
0:433 steps now: Do not rely on a single EDR verdict for credential-access.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.